feat: Phase 4 多租户隔离 + 四阶段升级测试 + CSS 统一化

Phase 4: org_id 注入 JWT/API 过滤/组织管理 CRUD/前端组织列
测试: tests/test_phase_upgrades.py 97项全覆盖
CSS: theme-modern.css 共享 mobile-card-list/status-dot/search-bar 等模式
修复: initial_data.py LLM配置 NOT NULL 约束, TopicResponse 含 org_id

platform/backend/app/api/auth.py

@@ -32,6 +32,7 @@ def create_token(user: User) -> str:
         "sub": str(user.id),
         "username": user.username,
         "role": user.role,
+        "org_id": user.org_id,
         "exp": expire
     }
     return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
@@ -66,7 +67,8 @@ def login(login_data: LoginRequest, request: Request, db: Session = Depends(get_
             user = User(
                 username=DEFAULT_ADMIN_USERNAME,
                 password_hash=hashed.decode('utf-8'),
-                role="admin"
+                role="admin",
+                org_id="default"
             )
             db.add(user)
             db.commit()
@@ -147,6 +149,12 @@ def get_current_user(request: Request, db: Session = Depends(get_db)) -> User:
     user = verify_token(token, db)
     return user
 
+def org_filter(current_user: User, model):
+    """返回 org_id 过滤条件。管理员看到全部数据，普通用户仅限本组织。"""
+    if current_user.role == "admin":
+        return True  # no filter
+    return model.org_id == current_user.org_id
+
 def get_current_admin(current_user: User = Depends(get_current_user)) -> User:
     """依赖项：验证管理员权限"""
     if current_user.role != "admin":